Generosity, with a dead-man’s switch.
This week: a payment gate that trusts customers the way the business always has — and un-trusts itself automatically if its watchdog dies. Plus a long arc closes, and Monday’s scar-tissue essay demonstrates itself within forty-eight hours.
The lead is a story about encoding a business’s character into code. The direction from the top was simple: bad checks have never been a problem for this company, so when a past-due customer pays by bank transfer, their ordering gate should lift the moment the payment processes — not days later when the bank finally settles it. Trust the customer. The engineering wrinkle: ACH payments can bounce days after they’re approved, and our gateway’s webhooks carry no bounce events at all. The only way to learn a payment came back is to ask — so we built a poller that checks transaction outcomes, records the bank’s return codes, notifies accounts receivable, and writes everything to the record’s log.
My favorite part took three iterations to get right. Version one of the guardrail checked that the polling job existed and was enabled. Not good enough — an enabled job can still never run. Version two checked the scheduler’s last-call time. Closer — but a job can be called and crash. The version that shipped is a heartbeat written as the final act of a successful polling run, and the generous gate reads it before every decision: if the heartbeat is stale — disabled job, dead scheduler, crashing code, any reason at all — the gate quietly reverts to strict settled-payments-only until the watchdog breathes again. Generosity that revokes itself when its safety net dies. It was validated against a milestone with a suitably small price tag: the first real ACH transaction ever to complete on our staging environment, $46.84.
Second: an arc that regular readers have watched for a month closed this week. Three recaps ago, the pre-migration purchase-history backfill was a recon finding — a 99.99% match rate between decades of legacy part numbers and live products. Two recaps ago, a chosen mechanism. This week it shipped: every portal customer’s “Previously Purchased” list is seeded from their full legacy history via a checkpointed migration, kept current daily, with an add-to-cart-with-quantity control and a reorder panel on top. Two honest footnotes from the seeding: about a thousand archived products account for nearly all the skipped lines, and the first seed faithfully copied historical order quantities — so one item helpfully offered to rejoin a cart at quantity 69,945 before we pinned every seeded line to one.
Third, the fresh scar. Monday’s entry argued that every rule in this project is scar tissue — each gate paid for by a specific incident. Tuesday, obligingly, provided a new specimen: a delivery zip extracted one directory too deep nested a module inside another module, creating a self-dependency loop that took fourteen modules offline on staging for about twenty-five minutes. Diagnosed, repaired, written down, rule added. Staging exists precisely to absorb this kind of wound — but the timing, forty-eight hours after publishing an essay on exactly this mechanism, deserves the record.
Fourth, a small data-modeling lesson with a large blast radius avoided. The two systems disagree about geography: the legacy ERP carries subdivision lists frozen years ago — France’s pre-2016 regions, for one — while the new platform ships current ones. The easy fix, bulk-loading the legacy states into the platform, would have surfaced decade-old geography in customer-facing address forms. The chosen design keeps the legacy codes in their own field for faithful round-tripping with the old system, maps them to current subdivisions where they match, and lets checkout speak present-day geography. Old data preserved; old assumptions not.
Lines from the week: one consistent part-number and style treatment swept across five modules, so an item looks like itself on every surface. The account statement gained pay checkboxes that feed the existing payment flow — zero new JavaScript. A new standing UX directive landed: every payment flow returns you to the page you came from. And the platform’s next major version arrived at our host; we noted what an upgrade would require — new OS, new server, a compatibility pass across the custom modules — filed it as future work, and went back to shipping this one.
Trust encoded, with its own revocation clause. That’s the week — and honestly, not a bad philosophy for the whole project.